Setting up two-step verification

With two-step verification (2FA) your password alone is no longer enough to sign in: a code from your authenticator app is also required.

Setting up

1. Go to Settings → Two-step verification and click Set up two-step verification.
2. Scan the QR code with your authenticator app (Google Authenticator, 1Password, Authy — any app works). Manual entry with the shown key also works.
3. Enter the 6-digit code from the app to confirm.

Recovery codes

After enabling you are shown eight recovery codes — once. Store them somewhere safe (a password manager). If you lose your phone, sign in with a recovery code; each code works once.

Signing in

When you sign in with your password, the code screen follows: enter the code from your app, or a recovery code. If you sign in with Google, Google's own verification counts as the second step.

Disabling

You can disable 2FA on the same settings page; that also requires a valid code (or recovery code), so nobody else can quietly switch it off.